MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da3b89a6cea23b94c42d962ca11c66b69a601eebc11da6a19cced2713fd2adc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da3b89a6cea23b94c42d962ca11c66b69a601eebc11da6a19cced2713fd2adc6
SHA3-384 hash: 4571d9a8417c84af7a0b567be80c0d3333fa1022d19acb38f10f0fafbb7f328c469f4c9c9a44d947ae0a4f0021006276
SHA1 hash: 81b77b57446da19423a0de5a85201231cfc3b910
MD5 hash: dde472313691c740da1fba08380956d0
humanhash: august-emma-steak-lemon
File name:TT-tomodatii.CAB
Download: download sample
Signature AgentTesla
Create hunting rule
File size:303'967 bytes
First seen:2020-05-04 21:33:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fxW1m769Z2TRkeo9YpIHFyCwCwybDOx+XcUaFhBC7QNFC37xWpE:pW1m769Z+RkeoeyFzwCwybCpBCOF8d
TLSH 6C54228677D2CF9310F071E05EED3E545E820D5728CED6BEB160184E8B8427FBDA9686
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sip1-210.nexcess.net
Sending IP: 209.126.18.174
From: Tomodatti <contato@tomodatti.com.br>
Reply-To: contato@tomodatti.com.br
Subject: Banco TT rápida cópia
Attachment: TT-tomodatii.CAB (contains "TT-tomodatii.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 21:37:09 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3i5ytjwoui5zjrbnsywkchdgw2ngahxlyeo2nim4z3jhcp6svxda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip da3b89a6cea23b94c42d962ca11c66b69a601eebc11da6a19cced2713fd2adc6

(this sample)

AgentTesla

Executable exe 96dc3223427540f520a952e0582b91a0ef388e8f7b6122b838236b1a85e89881

  
Dropping
MD5 f609bc8bd3d87d589c28174113ad9d61
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96dc3223427540f520a952e0582b91a0ef388e8f7b6122b838236b1a85e89881

Comments